CLEANSTART-2026-DP81887 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

Security vulnerability affects the azure-functions-node package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon...

CLEANSTART-2026-LD22017 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

Security vulnerability affects the azure-functions-node package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon...

CLSA-2026-1792746952 TuxCare security update for @grpc/grpc-js (2 CVEs)

TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.14.4-tuxcare.1...

CLSA-2026-1792745716 TuxCare security update for @grpc/grpc-js (2 CVEs)

TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.12.6-tuxcare.1...

CLSA-2026-1792745535 TuxCare security update for @grpc/grpc-js (2 CVEs)

TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.9.16-tuxcare.1...

CLSA-2026-1792745507 TuxCare security update for @grpc/grpc-js (2 CVEs)

TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 1.3.8-tuxcare.1...

CLSA-2026-1792603525 TuxCare security update for @grpc/grpc-js (2 CVEs)

TuxCare rebuilt @grpc/grpc-js to address 2 CVEs. Fixed in 0.6.9-tuxcare.1...

PT-2026-122736

Security vulnerability affects the langfuse package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon...

PT-2026-122686

Security vulnerability affects the langfuse package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon...

ROOT-APP-NPM-CVE-2026-48068 CVE-2026-48068 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2026-48068 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-101916 CVE-2026-101916 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2026-101916 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-37168 CVE-2024-37168 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2024-37168 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Impact When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the...

-temp-electron-manager-somiibo (0.0.200), 0utmailauth (1.0.0) +8557 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.0.0, <=1.13.5)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.14 and more Source cves: CVE-2026-101916 Source advisory: OSV:GHSA-M9GG-HP2V-232J...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +248 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.13.3, =0.0.4, =0.0.38 and more Source cves: CVE-2026-101916 Source advisory: OSV:GHSA-M9GG-HP2V-232J...

-temp-electron-manager-somiibo (0.0.200), 0utmailauth (1.0.0) +8557 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.0.0, <=1.13.5)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.14 and more Source cves: CVE-2026-101916 Source advisory: GHSA-M9GG-HP2V-232J...

GHSA-M9GG-HP2V-232J @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Impact When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +248 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.13.3, =0.0.4, =0.0.38 and more Source cves: CVE-2026-101916 Source advisory: GHSA-M9GG-HP2V-232J...

EUVD-2026-88476

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized...

-temp-electron-manager-somiibo (0.0.200), 0utmailauth (1.0.0) +8557 more potentially affected by CVE-2026-101915 via @grpc/grpc-js (>=1.0.0, <=1.13.5)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =0.0.14 and more Source cves: CVE-2026-101915 Source advisory: OSV:GHSA-F596-WHHP-79R4...